During the past seven decades, electronic computing has evolved from primitive, vacuum-tube-based computer systems, initially developed during the 1940s, to modern electronic computing systems in which large numbers of multi-processor servers, work stations, and other individual computing systems are networked together with large-capacity data-storage devices and other electronic devices to produce geographically distributed computing systems with hundreds of thousands, millions, or more components that provide enormous computational bandwidths and data-storage capacities. These large, distributed computing systems are made possible by advances in computer networking, distributed operating systems and applications, data-storage appliances, computer hardware, and software technologies. Despite all of these advances, however, the rapid increase in the size and complexity of computing systems has been accompanied by numerous scaling issues and technical challenges, including technical challenges associated with communications overheads encountered in parallelizing computational tasks among multiple processors, component failures, and distributed-system management. As new distributed-computing technologies are developed and as general hardware and software technologies continue to advance, the current trend towards ever-larger and more complex distributed computing systems appears likely to continue well into the future.
In modern computing systems, individual computers, subsystems, and components generally output large volumes of status, informational, and error messages that are collectively referred to, in the current document, as “event messages.” In large, distributed computing systems, terabytes of event messages may be generated each day. The event messages are often collected into event logs stored as files in data-storage appliances and are often analyzed both in real time, as they are generated and received, as well as retrospectively, after the event messages have been initially processed and stored in event logs. Event messages may contain information that can be used to detect serious failures and operational deficiencies prior to the accumulation of a sufficient number of failures and system-degrading events that lead to data loss and significant down time. The information contained in event messages may also be used to detect and ameliorate various types of security breaches and issues, to intelligently manage and maintain distributed computing systems, and to diagnose many different classes of operational problems, hardware-design deficiencies, and software-design deficiencies.
It has proved to be a challenging task for system administrators, system designers and developers, and system users to identify information within the enormous event logs generated in distributed computing systems relevant to detecting and diagnosing operational anomalies and useful in administering, managing, and maintaining distributed computer systems. System administrators, maintenance personnel, and other users of event messages continue to seek new automated methods and subsystems to facilitate using event logs to detect and diagnose operational anomalies and to administer, manage, and maintain distributed computer systems.